ci: add workflow auditing and fix violations

[Saviq]

No description provided.

[Copilot]

Pull request overview

This PR tightens CI/workflow security posture by adding zizmor workflow auditing and applying zizmor-driven remediations across existing GitHub Actions workflows.

Changes:

• Add zizmor as a pre-commit hook and introduce a .github/zizmor.yml config to manage rule exceptions.
• Harden multiple GitHub Actions workflows by setting permissions: {} at the workflow level and granting least-privilege per job.
• Pin third-party GitHub Actions to specific commit SHAs and disable persisted checkout credentials.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.pre-commit-config.yaml	Adds zizmor pre-commit hook with --fix to audit/fix workflow issues locally.
.github/zizmor.yml	Adds zizmor configuration to ignore specific workflows for secrets-outside-env.
.github/workflows/tics.yml	Applies least-privilege permissions, pins actions, and disables persisted credentials.
.github/workflows/tarball.yml	Applies least-privilege permissions, pins actions, and refactors inputs usage (introduces a quoting bug).
.github/workflows/spread.yml	Applies least-privilege permissions, pins actions, and disables persisted credentials.
.github/workflows/pre-commit.yaml	Applies least-privilege permissions and pins actions (but likely breaks auto-fix pushes).
.github/workflows/ppa-upload.yml	Applies least-privilege permissions, pins actions, and disables persisted credentials.